modiloader | 5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d

General

Target

5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe
Size

90KB
MD5

af177146ef049d52898fc75ffe431d2f
SHA1

a650aa61a2d02d7da038f64c93241f28c9f2e263
SHA256

5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d
SHA512

46725ae60f246efd01aacaac2b4899f83598d29a46da570c8e39d6d5026141c6905030ee9a41ef2a0faceff4a9f4d78e6fce5d1993b472d3ae90e58bb1264eb3
SSDEEP

1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y

Score

10^/10

modiloader persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Detects Windows executables referencing non-Windows User-Agents 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2044-55-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/2044-50-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/2044-49-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

ModiLoader Second Stage 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2044-55-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2
behavioral2/memory/2044-50-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2
behavioral2/memory/2044-49-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2

UPX dump on OEP (original entry point) 16 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2536-0-0x0000000000400000-0x0000000000453000-memory.dmp	UPX
behavioral2/memory/2704-7-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/memory/2704-10-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/memory/2704-9-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/memory/2536-14-0x0000000000400000-0x0000000000453000-memory.dmp	UPX
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe	UPX
behavioral2/memory/1028-36-0x0000000000400000-0x0000000000453000-memory.dmp	UPX
behavioral2/memory/1028-39-0x0000000000400000-0x0000000000453000-memory.dmp	UPX
behavioral2/memory/2044-44-0x0000000000400000-0x0000000000414000-memory.dmp	UPX
behavioral2/memory/2044-48-0x0000000000400000-0x0000000000414000-memory.dmp	UPX
behavioral2/memory/2044-55-0x0000000000400000-0x0000000000414000-memory.dmp	UPX
behavioral2/memory/1028-53-0x0000000000400000-0x0000000000453000-memory.dmp	UPX
behavioral2/memory/2044-50-0x0000000000400000-0x0000000000414000-memory.dmp	UPX
behavioral2/memory/2044-49-0x0000000000400000-0x0000000000414000-memory.dmp	UPX
behavioral2/memory/2704-58-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/memory/4408-59-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe

Executes dropped EXE 3 IoCs

Processes:

csrsll.execsrsll.execsrsll.exe

pid process

1028 csrsll.exe
4408 csrsll.exe
2044 csrsll.exe

pid	process
1028	csrsll.exe
4408	csrsll.exe
2044	csrsll.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2536-0-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/2704-7-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/2704-10-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/2704-9-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/2536-14-0x0000000000400000-0x0000000000453000-memory.dmp	upx
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe	upx
behavioral2/memory/1028-36-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/1028-39-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/2044-44-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/2044-48-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/2044-55-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/1028-53-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/2044-50-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/2044-49-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/2704-58-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/4408-59-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Win Pdf = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrsll.exe"	reg.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.execsrsll.exe

description	pid	process	target process
PID 2536 set thread context of 2704	2536	5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe	5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe
PID 1028 set thread context of 4408	1028	csrsll.exe	csrsll.exe
PID 1028 set thread context of 2044	1028	csrsll.exe	csrsll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

csrsll.exe

description	pid	process
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe
Token: SeDebugPrivilege	4408	csrsll.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.execsrsll.execsrsll.exe

pid	process
2536	5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe
2704	5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe
1028	csrsll.exe
4408	csrsll.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.execmd.execsrsll.exe

description	pid	process	target process
PID 2536 wrote to memory of 2704	2536	5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe	5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe
PID 2536 wrote to memory of 2704	2536	5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe	5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe
PID 2536 wrote to memory of 2704	2536	5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe	5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe
PID 2536 wrote to memory of 2704	2536	5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe	5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe
PID 2536 wrote to memory of 2704	2536	5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe	5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe
PID 2536 wrote to memory of 2704	2536	5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe	5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe
PID 2536 wrote to memory of 2704	2536	5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe	5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe
PID 2536 wrote to memory of 2704	2536	5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe	5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe
PID 2704 wrote to memory of 2088	2704	5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe	cmd.exe
PID 2704 wrote to memory of 2088	2704	5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe	cmd.exe
PID 2704 wrote to memory of 2088	2704	5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe	cmd.exe
PID 2088 wrote to memory of 4444	2088	cmd.exe	reg.exe
PID 2088 wrote to memory of 4444	2088	cmd.exe	reg.exe
PID 2088 wrote to memory of 4444	2088	cmd.exe	reg.exe
PID 2704 wrote to memory of 1028	2704	5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe	csrsll.exe
PID 2704 wrote to memory of 1028	2704	5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe	csrsll.exe
PID 2704 wrote to memory of 1028	2704	5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe	csrsll.exe
PID 1028 wrote to memory of 4408	1028	csrsll.exe	csrsll.exe
PID 1028 wrote to memory of 4408	1028	csrsll.exe	csrsll.exe
PID 1028 wrote to memory of 4408	1028	csrsll.exe	csrsll.exe
PID 1028 wrote to memory of 4408	1028	csrsll.exe	csrsll.exe
PID 1028 wrote to memory of 4408	1028	csrsll.exe	csrsll.exe
PID 1028 wrote to memory of 4408	1028	csrsll.exe	csrsll.exe
PID 1028 wrote to memory of 4408	1028	csrsll.exe	csrsll.exe
PID 1028 wrote to memory of 4408	1028	csrsll.exe	csrsll.exe
PID 1028 wrote to memory of 2044	1028	csrsll.exe	csrsll.exe
PID 1028 wrote to memory of 2044	1028	csrsll.exe	csrsll.exe
PID 1028 wrote to memory of 2044	1028	csrsll.exe	csrsll.exe
PID 1028 wrote to memory of 2044	1028	csrsll.exe	csrsll.exe
PID 1028 wrote to memory of 2044	1028	csrsll.exe	csrsll.exe
PID 1028 wrote to memory of 2044	1028	csrsll.exe	csrsll.exe
PID 1028 wrote to memory of 2044	1028	csrsll.exe	csrsll.exe
PID 1028 wrote to memory of 2044	1028	csrsll.exe	csrsll.exe

C:\Users\Admin\AppData\Local\Temp\5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe
"C:\Users\Admin\AppData\Local\Temp\5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536

C:\Users\Admin\AppData\Local\Temp\5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe
"C:\Users\Admin\AppData\Local\Temp\5b2492cdd814cd4ad2ad0f7d32433b314cc153c3e5db0787262e2fd5ecb9650d.exe"
2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TTBPO.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:2088

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f
4⤵
- Adds Run key to start application
PID:4444

C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1028

C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4408

C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"
4⤵
- Executes dropped EXE
PID:2044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TTBPO.txt
Filesize
145B

MD5
4eb61ec7816c34ec8c125acadc57ec1b

SHA1
b0015cc865c0bb1a027be663027d3829401a31cc

SHA256
08375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff

SHA512
f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe
Filesize
90KB

MD5
abe7d5c585aeecb0b637954e73794473

SHA1
65e709a086cc28b3fa7bd5b252e0c447a142cfce

SHA256
3a5a0943fa390f1530aa10205b0c2fc2d2e1c70f8dda8830ffd2c9554c887f06

SHA512
940d0298f39ffb9d699467ad05747f7cfe97f5c0ce9edd82499c8c5d79a7af0cfb3ec5e1fb11b7d2dda3ef290008681abb29982dbba49b3af27658d1eb0a643c

Download Submit
memory/1028-53-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1028-39-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1028-36-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2044-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2044-49-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2044-50-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2044-48-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2044-44-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2536-3-0x00000000021D0000-0x00000000021D2000-memory.dmp

Filesize
8KB

Download
memory/2536-4-0x00000000021E0000-0x00000000021E2000-memory.dmp

Filesize
8KB

Download
memory/2536-5-0x00000000021F0000-0x00000000021F2000-memory.dmp

Filesize
8KB

Download
memory/2536-14-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2536-0-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2536-6-0x0000000002200000-0x0000000002202000-memory.dmp

Filesize
8KB

Download
memory/2704-7-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2704-9-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2704-10-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2704-58-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2704-56-0x0000000000410000-0x00000000004D9000-memory.dmp

Filesize
804KB

Download
memory/4408-59-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads